search

Azure / terraform-azurerm-avm-res-network-expressroutecircuit

AVM Terraform module for ExpressRoute Circuits.
MIT License
1 stars 1 forks source link

readme

Azure ExpressRoute Circuit Deployment Module

This module helps you deploy an Azure ExpressRoute Circuit and its related dependencies. Before using this module, be sure to review the official Azure ExpressRoute Documentation.

[!IMPORTANT] As the overall AVM (Azure Virtual Machine) framework is not yet GA (Generally Available), the CI (Continuous Integration) framework and test automation may not be fully functional across all supported languages. Breaking changes are possible.

However, this DOES NOT imply that the modules are unusable. These modules CAN be used in all environments—whether dev, test, or production. Treat them as you would any other Infrastructure-as-Code (IaC) module, and feel free to raise issues or request features as you use the module. Be sure to check the release notes before updating to newer versions to review any breaking changes or considerations.

Resources Deployed by this Module

Deployment Process

  1. Deploy the ExpressRoute Circuit: Start by deploying the circuit. After deployment, extract the Service Key from the module's output.

  2. Work with Your Service Provider: Share the Service Key with your service provider to activate the circuit.

  3. Deploy Peering and Dependencies: Once the circuit status is Provisioned, deploy the peering, connections and any related services.

Note: If you attempt to deploy peering before the circuit is in the Provisioned state, the module deployment will fail. In Terraform, it’s recommended not to pass parameters for dependent resources (such as Peerings or Connections) until after the circuit is provisioned. This ensures a successful Terraform deployment and a stable state file.

Important Notes

Feedback

We welcome your feedback! If you encounter any issues or have feature requests, please raise them in the module’s GitHub repository.

Requirements

The following requirements are needed by this module:

Resources

The following resources are used by this module:

Required Inputs

The following input variables are required:

location

Description: (Required) The location of the ExpressRoute Circuit. Changing this forces a new resource to be created.

Type: string

name

Description: (Required) The name of the ExpressRoute Circuit. Changing this forces a new resource to be created.

Type: string

resource_group_name

Description: (Required) The name of the resource group where the resources will be deployed.

Type: string

sku

Description: (Required) A sku block for the ExpressRoute circuit.

Type:

object({
    tier   = string
    family = string
  })

Optional Inputs

The following input variables are optional (have default values):

allow_classic_operations

Description: (Optional) Allow the circuit to interact with classic (RDFE) resources. Defaults to false.

Type: bool

Default: false

authorization_key

Description: (Optional) The authorization key. This can be used to set up an ExpressRoute Circuit with an ExpressRoute Port from another subscription.

Type: string

Default: null

bandwidth_in_gbps

Description: (Optional) The bandwidth in Gbps of the circuit being created on the Express Route Port, should be set when the circuit is created with ER Direct.

Type: number

Default: null

bandwidth_in_mbps

Description: (Optional) The bandwidth in Mbps of the circuit being created on the Service Provider, should be set when the circuit is created with a provider.

Type: number

Default: null

diagnostic_settings

Description: A map of diagnostic settings to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

Type:

map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

enable_telemetry

Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.

Type: bool

Default: true

er_gw_connections

Description: (Optional) A map of association objects to create connections between the created circuit and the designated gateways.

Example Input:

er_gw_connections = {
  connection1er = {
    name                             = "ExRConnection-westus2-er"
    express_route_gateway_resource_id         = local.same_rg_er_gw_resource_id
    express_route_circuit_peering_resource_id = local.same_rg_er_peering_resource_id
    peering_map_key = "firstPeeringConfig"
    routeting_weight = 0
    routing = {
      inbound_route_map_resource_id         = azurerm_route_map.in.id
      outbound_route_map_resource_id        = azurerm_route_map.out.id
      propagated_route_table = {
        route_table_resource_ids = [
          azurerm_virtual_hub_route_table.example.id,
          azurerm_virtual_hub_route_table.additional.id
        ]
      }
    }
  }
}

Type:

map(object({
    name                                      = optional(string, "")
    express_route_circuit_peering_resource_id = optional(string, null)
    peering_map_key                           = optional(string, null)
    express_route_gateway_resource_id         = string
    authorization_key                         = optional(string, null)
    enable_internet_security                  = optional(bool, false)
    express_route_gateway_bypass_enabled      = optional(bool, false)
    # private_link_fast_path_enabled = optional(bool, false) # disabled due to bug #26746
    routing_weight = optional(number, 0)
    routing = optional(object({
      associated_route_table_resource_id = optional(string)
      inbound_route_map_resource_id      = optional(string)
      outbound_route_map_resource_id     = optional(string)
      propagated_route_table = object({
        labels                   = optional(list(string), null)
        route_table_resource_ids = optional(list(string), null)
      })
    }), null)
  }))

Default: {}

express_route_circuit_authorizations

Description: (Optional) A map of authorization objects to create authorizations for the ExpressRoute Circuits.

Example Input:

express_route_circuit_authorizations = {
  authorization1 = {
    name              = "authorization1"
  },
  authorization2 = {
    name              = "azurerm_express_route_gateway.some_gateway.name-authorization"
  }
}

Type:

map(object({
    name = string
  }))

Default: {}

express_route_port_resource_id

Description: (Optional) The ID of the Express Route Port this Express Route Circuit is based on. Changing this forces a new resource to be created.

Type: string

Default: null

exr_circuit_tags

Description: (Optional) A mapping of tags to assign to the ExpressRoute Circuit.

Type: map(string)

Default: null

lock

Description: Controls the Resource Lock configuration for this resource. The following properties can be specified:

Type:

object({
    kind = string
    name = optional(string, null)
  })

Default: null

peering_location

Description: (Optional) The name of the peering location and not the Azure resource location. Changing this forces a new resource to be created.
Don't set this parameter if the circuit is created with an ER Direct.

Type: string

Default: null

peerings

Description: (Optional) A map of association objects to create peerings between the created circuit and the designated gateways.

Example Input:

peerings = {
  PrivatePeering = {
    peering_type                  = "AzurePrivatePeering"
    peer_asn                      = 100
    primary_peer_address_prefix   = "10.0.0.0/30"
    secondary_peer_address_prefix = "10.0.0.4/30"
    ipv4_enabled                  = true
    vlan_id                       = 300

    ipv6 {
      primary_peer_address_prefix   = "2002:db01::/126"
      secondary_peer_address_prefix = "2003:db01::/126"
      enabled                       = true
    }
  },
  MicrosoftPeering = {
    peering_type                  = "MicrosoftPeering"
    peer_asn                      = 200
    primary_peer_address_prefix   = "123.0.0.0/30"
    secondary_peer_address_prefix = "123.0.0.4/30"
    ipv4_enabled                  = true
    vlan_id                       = 400

    microsoft_peering_config {
      advertised_public_prefixes = ["123.1.0.0/24"]
    }

    ipv6 {
      primary_peer_address_prefix   = "2002:db01::/126"
      secondary_peer_address_prefix = "2003:db01::/126"
      enabled                       = true

      microsoft_peering {
        advertised_public_prefixes = ["2002:db01::/126"]
      }
    }
  }
}

Type:

map(object({
    peering_type                  = string
    vlan_id                       = number
    primary_peer_address_prefix   = optional(string, null)
    secondary_peer_address_prefix = optional(string, null)
    ipv4_enabled                  = optional(bool, true)
    shared_key                    = optional(string, null)
    peer_asn                      = optional(number, null)
    route_filter_resource_id      = optional(string, null)
    microsoft_peering_config = optional(object({
      advertised_public_prefixes = list(string)
      customer_asn               = optional(number, null)
      routing_registry_name      = optional(string, "NONE")
      advertised_communities     = optional(list(string), null)
    }), null)
    ipv6 = optional(object({
      primary_peer_address_prefix   = string
      secondary_peer_address_prefix = string
      enabled                       = optional(bool, true)
      route_filter_resource_id      = optional(string, null)
      microsoft_peering = optional(object({
        advertised_public_prefixes = optional(list(string))
        customer_asn               = optional(number, null)
        routing_registry_name      = optional(string, "NONE")
        advertised_communities     = optional(list(string), null)
      }), null)
    }), null)
  }))

Default: {}

role_assignments

Description: A map of role assignments to create on this resource. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

Note: only set skip_service_principal_aad_check to true if you are assigning a role to a service principal.

Type:

map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))

Default: {}

service_provider_name

Description: (Optional) The name of the ExpressRoute Service Provider. Changing this forces a new resource to be created.

Type: string

Default: null

tags

Description: (Optional) Tags of the resource.

Type: map(string)

Default: null

vnet_gw_connections

Description: (Optional) A map of association objects to create connections between the created circuit and the designated gateways.

Example Input:

vnet_gw_connections = {
  connection1gw = {
    name                       = local.same_rg_conn_name
    virtual_network_gateway_resource_id = local.same_rg_gw_resource_id
    location                   = local.location
    resource_group_name        = local.resource_group_name
  }
}

Type:

map(object({
    name                                = optional(string, "")
    resource_group_name                 = string
    location                            = string
    virtual_network_gateway_resource_id = string
    authorization_key                   = optional(string, null)
    routing_weight                      = optional(number, 0)
    express_route_gateway_bypass        = optional(bool, false)
    private_link_fast_path_enabled      = optional(bool, false)
    shared_key                          = optional(string, null)
    tags                                = optional(map(string), null)
  }))

Default: {}

Outputs

The following outputs are exported:

authorization_keys

Description: Authorization keys for the ExpressRoute circuit.

authorization_used_status

Description: Authorization used status.

express_route_gateway_connections

Description: ExpressRoute gateway connections.

name

Description: The resource name of the ExpressRoute circuit.

peerings

Description: ExpressRoute Circuit peering configurations.

resource_id

Description: The resource ID of the ExpressRoute circuit.

virtual_network_gateway_connections

Description: Virtual network gateway connections.

Modules

No modules.

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.